GitHub Actions now issues read-only cache tokens to the default branch for workflow events that can be triggered without write permissions to the repository. This applies least privilege to the cache and prevents common privilege-escalation paths through cache poisoning.
Previously, the Actions service issued read-write cache tokens for every workflow event, including triggers like pull_request_target, issue_comment, and fork-pull-request workflow_run cascades. Workflow code that an external actor can influence (e.g., through script injection or “pwn requests”) could write to the default-branch cache, and a trusted workflow such as push or schedule would later restore those poisoned entries. This opened up a path to run arbitrary code and exfiltrate production secrets in these more trusted workflows.
To close that path, GitHub now issues a read-only cache token when both of these are true:
The triggering event is untrusted, meaning someone other than a repository collaborator can trigger the event.
The workflow execution context and cache scope come from the shared default-branch SHA.
